Build a SLAAC LAN from One /64 of Your Free /48

Disclosure up front: I run IPYE, a company that leases IP space. Most of this article is practical how-to; IPYE appears where a free /48, LOA, or ROA helps you try the work, with a short call to action at the end.

SLAAC (Stateless Address Autoconfiguration) lets IPv6 hosts configure their own addresses from router advertisements, with no DHCP server. It is the simplest way to number a LAN, and the only method every major client operating system supports. This article builds a SLAAC LAN from one /64 of a free IPv6 /48 from IPYE. The edge announces 2001:db8:100::/48 and the LAN uses 2001:db8:100:20::/64.

Why exactly a /64

SLAAC requires a /64 prefix. Hosts generate the last 64 bits of their address themselves, so a /56 or /80 on the LAN simply does not work with SLAAC. A /48 holds 65,536 /64s, so there is no reason to economise.

Router configuration with radvd

On the LAN router, give the interface an address and advertise the prefix:

ip -6 addr add 2001:db8:100:20::1/64 dev lan0

interface lan0 {
    AdvSendAdvert on;
    AdvLinkMTU 1500;
    prefix 2001:db8:100:20::/64 {
        AdvOnLink on;
        AdvAutonomous on;
    };
    RDNSS 2001:db8:100:20::1 {
    };
    DNSSL lan.example.net {
    };
};

AdvAutonomous on is the flag that tells hosts to generate addresses. RDNSS hands out the DNS server in the RA itself, which Android requires because it does not support DHCPv6 for addresses or DNS. Enable forwarding on the router with sysctl -w net.ipv6.conf.all.forwarding=1.

The same thing in systemd-networkd:

[Network]
Address=2001:db8:100:20::1/64
IPv6SendRA=yes

[IPv6SendRA]
DNS=2001:db8:100:20::1
Domains=lan.example.net

[IPv6Prefix]
Prefix=2001:db8:100:20::/64

What hosts do with it

A typical client ends up with several addresses:

• a link-local fe80:: address
• a stable address for incoming connections, usually generated with RFC 7217 so it does not reveal the MAC address
• one or more temporary privacy addresses (RFC 8981) used for outgoing connections and rotated regularly

On Linux, check with ip -6 addr show dev eth0. Addresses marked temporary are privacy addresses. The stable address mode is set by net.ipv6.conf.eth0.addr_gen_mode, where 2 or 3 means stable-privacy.

Servers on a SLAAC LAN

Servers need predictable addresses for DNS. Options:

• Assign a static address on the server, for example 2001:db8:100:20::53, alongside SLAAC.
• Use a stable-privacy address and publish it in DNS. It stays the same as long as the prefix and interface do not change.
• Use a token: ip token set ::53 dev eth0 makes the host combine the advertised prefix with a fixed interface identifier.

Turn off temporary addresses on servers (net.ipv6.conf.eth0.use_tempaddr=0) so outbound connections come from the address you expect.

Adding DHCPv6 later

SLAAC and DHCPv6 can coexist. Setting the O flag (AdvOtherConfigFlag on; in radvd) tells hosts to fetch extra settings such as DNS from DHCPv6 while still building addresses with SLAAC. Setting the M flag asks for addresses from DHCPv6 as well, which Android ignores. Keep AdvAutonomous on if any Android devices use the LAN, or they will end up without a global address.

Firewall the LAN

Every host now has a global address. The router must default-deny new inbound connections to the LAN:

chain forward {
  type filter hook forward priority 0; policy drop;
  ct state established,related accept
  meta l4proto ipv6-icmp accept
  iifname "lan0" accept
}

Add explicit accept rules for anything you want to publish, and keep ICMPv6 open so path MTU discovery works.

Protect the RAs

Any host on the LAN can send router advertisements. A misconfigured laptop running connection sharing can become everyone's default router. Managed switches offer RA Guard, which drops RAs from ports that are not router ports. On unmanaged networks, watch for rogue RAs with rdisc6 lan0 or radvdump, which show every router advertising on the segment.

Verify

From a client:

rdisc6 eth0
ip -6 route show default
ping -6 -c 3 2001:db8:100::1
curl -6 https://ifconfig.co

The last command should return an address inside 2001:db8:100:20::/64, which shows the edge is routing the LAN through your announced prefix.

Paperwork

Only the /48 is announced, so the LAN needs no extra ROA. If the edge moves to a new host, download a fresh LOA from the IPYE portal; the LAN addresses stay the same.

Do this next

Claim a free /48 from IPYE, pick one /64 for the LAN, and check with rdisc6 that only your router is advertising. Questions: [e-mail].

About IPYE

IPYE (https://ipye.com) leases IPv4, IPv6 and ASN space with instant setup. Your first IPv6 /48 is free for the first year, a real allocation you can announce on your own ASN, with a LOA from the portal and the ROA created automatically. ASN and region changes apply automatically. IPv4 /24 to /22 leases include LOA, ROA and per-/24 rDNS; WHOIS is editable on IPv6 /44 and larger. Locations: Los Angeles, New York, Ashburn, Salt Lake City, London, Amsterdam, Frankfurt. Claim your free /48: https://my.ipye.com/products/ipv6-rental. Questions: [e-mail].

Disclosure: I run IPYE